Large-scale data processing systems such as web services and the like can produce vast amounts of log data including data generated by various end users, such as visitors of a network site and users of a mobile application. From time to time, it may be desirable to review such data to identify events of interest. For example, a marketing department may desire to identify behavioral patterns of individual users. However, the quantity of log data generated by such systems may present significant difficulties in terms of data storage and review. Querying data stores having millions to billions of entries, for example, may consume bandwidth, monopolize computing resources, and provide slow search results.